About

harkenzo is an independent security researcher specializing in desktop application security, with a focus on password managers and credential storage tools.

Disclosure Policy

I follow a 90-day coordinated disclosure timeline. Vendors are notified privately and given 90 days to release a patch before public disclosure. If a vendor is unresponsive after 90 days, the advisory is published with appropriate redaction of weaponized details.

CVEs

• CVE-2023-52252 - Unified Remote RCE
• CVE-2023-36266 - Keeper Password Dumping

Contact

harkenzo at tlstickle.com

For PGP-encrypted communication, request my public key via email.